Sub-processors

Primary application database and serverless functions runtime.

• Account profile
• Campaign and offer records
• Messaging content
• Payment metadata

Web application hosting and global edge / CDN delivery for the Next.js application, plus product analytics (page views and custom events) and Core Web Vitals real-user monitoring.

• Request metadata
• IP address (transient)
• Page and route visited
• Device, browser and connection metrics
• Visitor-level Core Web Vitals measurements

User authentication, session management and account security.

• Email address
• Name
• Authentication factors
• Session metadata

Payment processing, Stripe Connect payouts and invoice billing.

• Name
• Email address
• Payment instrument metadata
• Transaction history
• Tax identifiers

Self-employed payouts, tax withholding and Skatteverket KU10/AGI reporting for Swedish influencers.

• Name
• Personnummer
• Bank account details
• Payout amount

Error monitoring and application performance telemetry.

Reports carry a pseudonymous user ID. App reports keep chat contents and sign-in headers out; web and server reports also redact email addresses, identity numbers and tokens.

• Stack traces
• Request metadata
• User identifier (pseudonymised)

Transactional email delivery (notification, campaign and account emails sent from the platform).

Engaged only when email sending is configured for the deployment (`EMAIL_PROVIDER_API_KEY`); no marketing email is sent without opt-in consent.

• Recipient email address
• Email subject and body
• Delivery, bounce and complaint events

Push-notification relay for the Collabify mobile app — forwards notifications to Apple APNs and Google FCM.

Only engaged when a user enables push notifications on a device.

• Device push token
• Notification title and body
• Delivery receipts

AI-assisted post-description and scheduling-prompt generation.

Engaged under zero-retention API terms; prompts are not used for model training.

• Campaign briefs
• Influencer-supplied draft content

AI model routing for campaign-brief drafting and, when the creator has consented to AI analysis, the advisory AI review of a submitted campaign video against its brief and the feedback on its caption (shown to the business reviewer and the creator).

Video-review requests ask OpenRouter to route only to providers that do not use the data for training; the caption score endpoint has no such setting. The review and the score are advisory — the business reviewer decides.

• Campaign briefs
• Business-supplied draft text
• Submitted campaign video and caption (advisory review and caption feedback; with the creator's consent only)

Model provider behind the caption quality score: when the creator has consented to AI analysis, the caption of a submitted campaign video is scored by TypeSafe's Jev model, reached through OpenRouter (see the OpenRouter entry). The score is advisory feedback shown to the business reviewer and the creator. Jev also makes typed judgments in campaign creation (brand niches, campaign ideas, the brief interview) over brand and campaign text supplied by the business or read from the brand's public website.

The caption score sends the caption text and the campaign context it is judged against — no account identifiers, profile data or video. The score is advisory; the business reviewer decides.

• Caption of a submitted campaign video (with the creator's consent only)
• Brand name and the campaign's key messages and guidelines
• Brand and campaign text supplied by the business or read from the brand's public website (campaign creation)

Model provider behind the advisory AI video review: when the creator has consented to AI analysis, a submitted campaign video is reviewed by Google's Gemini model against a checklist compiled from the campaign brief, reached through OpenRouter (see the OpenRouter entry). A video sent inline is routed to Google Vertex AI only. The review is advisory notes for the business reviewer.

Each request asks OpenRouter to route only to providers that do not use the prompt for training. Google may keep it for a limited period for abuse monitoring. The review is advisory; the business reviewer decides.

• Submitted campaign video, or a smaller analysis copy of it (with the creator's consent only)
• Caption of the submitted video
• Campaign brief requirements and the checklist compiled from them
• Brand name and deliverable name

OAuth-based access to a user's TikTok account for content publishing and analytics.

Only engaged when a user explicitly connects their TikTok account.

• OAuth access and refresh tokens
• Public profile data (display name, username, avatar, bio, follower/likes counts)
• Statistics of videos published through Collabify
• The approved video, caption and post settings sent for publishing

OAuth-based merchant integration for product sync and discount-code provisioning.

Only engaged when a business connects a Shopify store.

• Shop domain
• Product catalogue
• Discount codes
• Order references

Authenticated REST API access to a merchant's WooCommerce store for product sync.

Only engaged when a business connects a WooCommerce store.

• Store URL
• Product catalogue
• Order references